Threat Hunting Vocabulary
Practice threat hunting vocabulary: IOC hunting, hypothesis-driven approaches, MITRE ATT&CK, lateral movement, and discovering unknown threats.
0 / 26 completed
1 / 26
A security analyst says 'The threat hunter proactively searches for IOCs.' What are IOCs?
Indicators of Compromise (IOCs) are forensic artifacts that suggest a system or network has been breached. Threat hunters proactively search for these — file hashes of known malware, C2 domain names, unusual registry keys — rather than waiting for alerts to fire.
2 / 26
Your threat hunting team uses 'hypothesis-driven hunting.' What does this approach involve?
Hypothesis-driven threat hunting starts with a specific hypothesis informed by threat intelligence and the MITRE ATT&CK framework — e.g., 'If an attacker gained initial access via phishing, they would likely use PowerShell for persistence.' Hunters then actively search for evidence of that specific technique.
3 / 26
A threat hunter says 'The MITRE ATT&CK framework guides the hunt.' What does MITRE ATT&CK provide?
MITRE ATT&CK is a globally accessible knowledge base that categorizes adversary behaviors into tactics (goals) and techniques (methods). Threat hunters use it to systematically search for specific attacker behaviors — e.g., 'Credential Dumping' (T1003) — rather than searching blindly.
4 / 26
A hunt report says 'We found evidence of lateral movement.' What is lateral movement in a security context?
Lateral movement refers to techniques attackers use after gaining initial access to move across the network — compromising additional systems, escalating privileges, and getting closer to high-value targets. Evidence of lateral movement (unusual authentication events, pass-the-hash artifacts) indicates an active or past breach.
5 / 26
Your hunt team reports 'The hunt revealed a previously unknown backdoor.' What type of threat did this discover?
This is a key value proposition of threat hunting — discovering threats that bypass automated detection. Known IOCs are found by automated tools; sophisticated attackers use custom tools that don't match signatures. Human-driven hunts find these unknown threats through behavioral analysis and anomaly detection.
6 / 26
PR Description: "Investigating suspicious user activity. Detected unusual API calls from User ID 12345 to internal database servers. Possible data exfiltration attempt. Requesting review of recent code changes by this user."This scenario presents a realistic code review situation. Simply rejecting the PR based on one unusual API call would be overly cautious and could block legitimate development. The correct answer emphasizes a targeted security audit – a core threat hunting principle – to understand the context of those calls and determine if they represent malicious activity. Options A and D are too extreme, while option C ignores the potential risk entirely.
7 / 26
PR Description: "Analyzing unusual network traffic patterns originating from server XYZ-101. We've identified a series of outbound connections to an external IP address (203.0.113.45) exceeding typical baseline activity by over 300%. Initial investigation suggests potential Command & Control (C&C) communication. Please review recent deployments and security configurations."This scenario highlights a crucial aspect of threat hunting: prioritizing based on anomalies. While a full audit might be necessary eventually, immediately focusing on the root cause – in this case, recent deployments – is a more efficient approach. The question tests understanding that a significant deviation from baseline activity warrants immediate investigation rather than assuming an immediate malicious intent. Option D is incorrect as it dismisses valuable data; a 300% increase is highly suspect.
8 / 26
PR Description: "Our automated detection system flagged a potential privilege escalation attempt. Process process_data.exe on Server ABC-789 consistently accessed the SYSTEM account without legitimate justification in the last 24 hours. The process's execution log shows multiple calls to undocumented functions within the Windows API. We're currently investigating whether this is related to a recent code update or an external vulnerability."Insufficient — while privilege escalation attempts can occur, the specific details – consistent use of the
SYSTEM account and undocumented API calls – strongly suggest a more serious issue than a simple anomaly. The question aims to test understanding of how threat hunting goes beyond basic alerts by examining behavioral indicators that warrant deeper investigation. A correct answer acknowledges the need for further scrutiny based on these concerning signs.9 / 26
/users/ endpoint with unusually high frequency. I'm going to investigate if this could be an attempt at brute-force credential stuffing.' Which of the following best describes what Sarah is focusing on?
The correct answer is Credential Stuffing. While brute-force and lateral movement are possibilities, 'credential stuffing' perfectly captures Sarah's observation – using known good/bad credentials from other breaches to access systems. The high frequency of requests targeting a user ID endpoint strongly suggests this tactic. Options 1 & 2 represent specific attack types, while option 3 is a broader category that doesn't quite match the context of frequent requests to a single user endpoint.
10 / 26
PR Description: "Investigating suspicious user activity. Detected unusual API calls from User ID 12345 to internal database servers. Possible data exfiltration attempt. Requesting review of recent code changes by this user."This scenario presents a realistic code review situation. Simply rejecting the PR based on one unusual API call would be overly cautious and could block legitimate development. The correct answer emphasizes a targeted security audit – a core threat hunting principle – to understand the context of those calls and determine if they represent malicious activity. Options A and D are too extreme, while option C ignores the potential risk entirely.
11 / 26
PR Description: "Analyzing unusual network traffic patterns originating from server XYZ-101. We've identified a series of outbound connections to an external IP address (203.0.113.45) exceeding typical baseline activity by over 300%. Initial investigation suggests potential Command & Control (C&C) communication. Please review recent deployments and security configurations."This scenario highlights a crucial aspect of threat hunting: prioritizing based on anomalies. While a full audit might be necessary eventually, immediately focusing on the root cause – in this case, recent deployments – is a more efficient approach. The question tests understanding that a significant deviation from baseline activity warrants immediate investigation rather than assuming an immediate malicious intent. Option D is incorrect as it dismisses valuable data; a 300% increase is highly suspect.
12 / 26
PR Description: "Our automated detection system flagged a potential privilege escalation attempt. Process process_data.exe on Server ABC-789 consistently accessed the SYSTEM account without legitimate justification in the last 24 hours. The process's execution log shows multiple calls to undocumented functions within the Windows API. We're currently investigating whether this is related to a recent code update or an external vulnerability."Insufficient — while privilege escalation attempts can occur, the specific details – consistent use of the
SYSTEM account and undocumented API calls – strongly suggest a more serious issue than a simple anomaly. The question aims to test understanding of how threat hunting goes beyond basic alerts by examining behavioral indicators that warrant deeper investigation. A correct answer acknowledges the need for further scrutiny based on these concerning signs.13 / 26
/users/ endpoint with unusually high frequency. I'm going to investigate if this could be an attempt at brute-force credential stuffing.' Which of the following best describes what Sarah is focusing on?
The correct answer is Credential Stuffing. While brute-force and lateral movement are possibilities, 'credential stuffing' perfectly captures Sarah's observation – using known good/bad credentials from other breaches to access systems. The high frequency of requests targeting a user ID endpoint strongly suggests this tactic. Options 1 & 2 represent specific attack types, while option 3 is a broader category that doesn't quite match the context of frequent requests to a single user endpoint.
14 / 26
PR Description: "Investigating suspicious user activity. Detected unusual API calls from User ID 12345 to internal database servers. Possible data exfiltration attempt. Requesting review of recent code changes by this user."This scenario presents a realistic code review situation. Simply rejecting the PR based on one unusual API call would be overly cautious and could block legitimate development. The correct answer emphasizes a targeted security audit – a core threat hunting principle – to understand the context of those calls and determine if they represent malicious activity. Options A and D are too extreme, while option C ignores the potential risk entirely.
15 / 26
PR Description: "Analyzing unusual network traffic patterns originating from server XYZ-101. We've identified a series of outbound connections to an external IP address (203.0.113.45) exceeding typical baseline activity by over 300%. Initial investigation suggests potential Command & Control (C&C) communication. Please review recent deployments and security configurations."This scenario highlights a crucial aspect of threat hunting: prioritizing based on anomalies. While a full audit might be necessary eventually, immediately focusing on the root cause – in this case, recent deployments – is a more efficient approach. The question tests understanding that a significant deviation from baseline activity warrants immediate investigation rather than assuming an immediate malicious intent. Option D is incorrect as it dismisses valuable data; a 300% increase is highly suspect.
16 / 26
PR Description: "Our automated detection system flagged a potential privilege escalation attempt. Process process_data.exe on Server ABC-789 consistently accessed the SYSTEM account without legitimate justification in the last 24 hours. The process's execution log shows multiple calls to undocumented functions within the Windows API. We're currently investigating whether this is related to a recent code update or an external vulnerability."Insufficient — while privilege escalation attempts can occur, the specific details – consistent use of the
SYSTEM account and undocumented API calls – strongly suggest a more serious issue than a simple anomaly. The question aims to test understanding of how threat hunting goes beyond basic alerts by examining behavioral indicators that warrant deeper investigation. A correct answer acknowledges the need for further scrutiny based on these concerning signs.17 / 26
/users/ endpoint with unusually high frequency. I'm going to investigate if this could be an attempt at brute-force credential stuffing.' Which of the following best describes what Sarah is focusing on?
The correct answer is Credential Stuffing. While brute-force and lateral movement are possibilities, 'credential stuffing' perfectly captures Sarah's observation – using known good/bad credentials from other breaches to access systems. The high frequency of requests targeting a user ID endpoint strongly suggests this tactic. Options 1 & 2 represent specific attack types, while option 3 is a broader category that doesn't quite match the context of frequent requests to a single user endpoint.
18 / 26
PR Description: "Investigating suspicious user activity. Detected unusual API calls from User ID 12345 to internal database servers. Possible data exfiltration attempt. Requesting review of recent code changes by this user."This scenario presents a realistic code review situation. Simply rejecting the PR based on one unusual API call would be overly cautious and could block legitimate development. The correct answer emphasizes a targeted security audit – a core threat hunting principle – to understand the context of those calls and determine if they represent malicious activity. Options A and D are too extreme, while option C ignores the potential risk entirely.
19 / 26
PR Description: "Analyzing unusual network traffic patterns originating from server XYZ-101. We've identified a series of outbound connections to an external IP address (203.0.113.45) exceeding typical baseline activity by over 300%. Initial investigation suggests potential Command & Control (C&C) communication. Please review recent deployments and security configurations."This scenario highlights a crucial aspect of threat hunting: prioritizing based on anomalies. While a full audit might be necessary eventually, immediately focusing on the root cause – in this case, recent deployments – is a more efficient approach. The question tests understanding that a significant deviation from baseline activity warrants immediate investigation rather than assuming an immediate malicious intent. Option D is incorrect as it dismisses valuable data; a 300% increase is highly suspect.
20 / 26
PR Description: "Our automated detection system flagged a potential privilege escalation attempt. Process process_data.exe on Server ABC-789 consistently accessed the SYSTEM account without legitimate justification in the last 24 hours. The process's execution log shows multiple calls to undocumented functions within the Windows API. We're currently investigating whether this is related to a recent code update or an external vulnerability."Insufficient — while privilege escalation attempts can occur, the specific details – consistent use of the
SYSTEM account and undocumented API calls – strongly suggest a more serious issue than a simple anomaly. The question aims to test understanding of how threat hunting goes beyond basic alerts by examining behavioral indicators that warrant deeper investigation. A correct answer acknowledges the need for further scrutiny based on these concerning signs.21 / 26
/users/ endpoint with unusually high frequency. I'm going to investigate if this could be an attempt at brute-force credential stuffing.' Which of the following best describes what Sarah is focusing on?
The correct answer is Credential Stuffing. While brute-force and lateral movement are possibilities, 'credential stuffing' perfectly captures Sarah's observation – using known good/bad credentials from other breaches to access systems. The high frequency of requests targeting a user ID endpoint strongly suggests this tactic. Options 1 & 2 represent specific attack types, while option 3 is a broader category that doesn't quite match the context of frequent requests to a single user endpoint.
22 / 26
During a standup update, David (a security analyst) says: 'We've observed an increase in failed login attempts to the application server, specifically targeting user accounts with limited privileges. The logs show a spike originating from a single IP address – 192.0.2.10. What is the most appropriate term to describe this situation when communicating it to the development team?',
A 'Brute Force Attack' refers to repeatedly attempting different passwords until one is successful. While a limited-privilege target could be part of an attack, the *spike* in failed attempts originating from a single IP strongly suggests a brute force attempt. 'Lateral Movement' describes movement within a network after gaining access; this focuses on the initial attack itself. An 'Insider Threat' implies malicious activity by someone already inside the organization.
23 / 26
In a Slack conversation regarding a potential threat, Liam (a developer) posts: 'The SIEM alerted us to unusual API calls from user ID 789012 to our internal payment processing service. The requests are significantly larger than usual and include data fields we don't typically transmit. What technical term best describes this scenario?'.
'Data Exfiltration' is the precise term for the unauthorized transfer of sensitive data. While a DDoS attack uses overwhelming traffic, and malware infection can lead to unusual API calls, the description focuses on *what* is being taken – the data itself. 'Ransomware activity' doesn't directly describe the type of API call; it describes the resulting action.
24 / 26
During a code review, Sarah (the threat hunter) notes in a comment on a PR: 'The service is attempting to write directly to the database without any input validation. This could allow an attacker to inject malicious SQL commands and compromise our data'. What security principle does this highlight?
'Input Validation' is the process of ensuring that user-supplied data meets specific criteria before being processed. Failing to validate input creates a vulnerability for SQL injection attacks – where an attacker can manipulate database queries. 'Least Privilege' restricts access rights; 'Defense in Depth' refers to multiple layers of security, and 'Zero Trust' is a broader architectural approach.
25 / 26
A system administrator sends a message to the development team: 'We've detected an instance where process `backup_agent.exe` on server `prod-server-02` is consuming excessive CPU resources and regularly accessing network shares containing sensitive configuration files. This behavior deviates significantly from its typical operational profile. What term best describes this situation?'.
'Resource Exhaustion' accurately reflects the scenario where a process is consuming excessive CPU and accessing sensitive files beyond its intended function. A 'Rootkit Installation' would hide malicious activity; a 'Memory Leak' is a gradual degradation of system resources, and a 'Kernel Panic' is a critical system error.
26 / 26
In a Slack channel discussing a potential threat, Mark (a developer) reports: 'Our automated intrusion detection system triggered an alert due to unusually high outbound traffic from server `webserver01` connecting to a known command and control server. The traffic patterns exhibited characteristics associated with botnet activity'. What is the core concept being described here?
A 'Command and Control (C&C) Channel' is a direct communication link between an infected device (the botnet) and its attacker. It's the conduit through which instructions are sent and data is received. While other options describe different types of attacks, this specifically refers to the established connection for remote control.
Frequently Asked Questions
What does the "Threat Hunting Vocabulary" exercise practise?
Practice threat hunting vocabulary: IOC hunting, hypothesis-driven approaches, MITRE ATT&CK, lateral movement, and discovering unknown threats.
How many questions are in this exercise?
This exercise has 26 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Cybersecurity category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Threat Hunting Vocabulary" part of a larger series?
Yes — it's one exercise in the Cybersecurity category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Cybersecurity category page for related exercises, or browse the main Exercises hub for other IT English topics.